Switch base images from Docker Hub to GHCR mirror

Avoids Docker Hub 429 rate limits by pulling node:20-alpine and
nginx:stable-alpine from ghcr.io/cartsnitch/mirror/. GHCR login
now runs on all builds (not just main push) to authenticate pulls.

Ref: cartsnitch/infra#7, CAR-55

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.dockerignore

@@ -0,0 +1,8 @@
+node_modules
+dist
+.git
+.github
+*.md
+.env*
+.vscode
+coverage

.github/workflows/ci.yml

@@ -20,7 +20,7 @@ env:
 
 jobs:
   lint:
-    runs-on: local-ubuntu-latest
+    runs-on: local-ubuntu-latest-cartsnitch
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -34,7 +34,7 @@ jobs:
         run: npx tsc --noEmit
 
   test:
-    runs-on: local-ubuntu-latest
+    runs-on: local-ubuntu-latest-cartsnitch
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -46,13 +46,12 @@ jobs:
         run: npx vitest run
 
   build-and-push:
-    runs-on: local-ubuntu-latest
+    runs-on: local-ubuntu-latest-cartsnitch
     needs: [lint, test]
     steps:
       - uses: actions/checkout@v4
 
       - name: Log in to GHCR
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}

Dockerfile

@@ -0,0 +1,21 @@
+# Stage 1: Build
+FROM ghcr.io/cartsnitch/mirror/node:20-alpine AS build
+
+WORKDIR /app
+
+COPY package.json package-lock.json ./
+RUN npm ci
+
+COPY . .
+RUN npm run build
+
+# Stage 2: Production
+FROM ghcr.io/cartsnitch/mirror/nginx:stable-alpine AS prod
+
+COPY --from=build /app/dist /usr/share/nginx/html
+COPY nginx.conf /etc/nginx/conf.d/default.conf
+
+EXPOSE 80
+
+HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
+  CMD wget -qO- http://localhost/health || exit 1

nginx.conf

@@ -0,0 +1,35 @@
+server {
+    listen 80;
+    server_name _;
+    root /usr/share/nginx/html;
+    index index.html;
+
+    # Gzip compression
+    gzip on;
+    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript image/svg+xml;
+    gzip_min_length 256;
+
+    # Health endpoint for K8s probes
+    location /health {
+        access_log off;
+        return 200 'ok';
+        add_header Content-Type text/plain;
+    }
+
+    # Cache static assets aggressively (Vite hashes filenames)
+    location /assets/ {
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+    }
+
+    # Service worker — must not be cached
+    location /sw.js {
+        expires off;
+        add_header Cache-Control "no-cache, no-store, must-revalidate";
+    }
+
+    # SPA fallback — serve index.html for all routes
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+}

renovate.json

@@ -0,0 +1,4 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["local>cartsnitch/.github:renovate-config"]
+}